Behavioral task
behavioral1
Sample
Бриллианты.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Бриллианты.exe
Resource
win10v2004-20240802-en
General
-
Target
089890fb82a54a2894b3ff65f36a8624_JaffaCakes118
-
Size
458KB
-
MD5
089890fb82a54a2894b3ff65f36a8624
-
SHA1
3ddf28dc9cafba62e41ef1fce9c287c86079354e
-
SHA256
01a03f28004632d3477fc6b95b244350b8513e1630cfa598fed97c50e7601df0
-
SHA512
45e203acf810a59976bc38a1c2219c4271d7701c74fe528fc76d0f5dd326486da9de97a20876ae199cc179e5102616391752e2cde6e44600458841c5ee7618d0
-
SSDEEP
12288:caWHhEckAbs/WJYLmndB0rbiB1hR4F21QV1CwoLbiPaQDi:+HCckAbiLsB0rbuR4FgckmdO
Malware Config
Signatures
-
resource yara_rule static1/unpack002/Бриллианты.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Бриллианты.exe
Files
-
089890fb82a54a2894b3ff65f36a8624_JaffaCakes118.eml
-
=?koi8-r?B?4tLJzMzJwc7U2S5yYXI=?=.rar
-
Бриллианты.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 339KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
email-plain-1.txt